<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>- Yes. They discovered Chinese closed-source metasploit tools.
Just in time for marketing rollout.</p>
<p>- Meat that I can use to check safety of my systems? Nay!</p>
<p>- No CVE references.<br>
</p>
<p>- Quote from page 16:</p>
<p>"""</p>
<p>BlackBerry researchers found that each of the victims’ kernel
versions indicated they<br>
were all running various versions of Red Hat Enterprise Linux or
CentOS – by using this<br>
information it was possible to discover the earliest possible
compromise date for each<br>
victim (Red Hat, 2019).<br>
</p>
<p>"""</p>
<p>- Again this theme, make sure that servers can't call outside. Do
egress filtering. Dev's of Jira and Confluence seem not to hear
this, though. Ya, friendly reminder that by default all your
docker containers in docker swarm can get out. What about K8's
networks?<br>
</p>
<p>My 2 cents.<br>
</p>
<div class="moz-cite-prefix">On 2020-04-08 7:17 p.m., Ron Singh
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CALQNZN5jktARnTknaqBkV+FwggXCeV8g0r-83bqVLBttA-Gz2w@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">
<div class="gmail_default" style="font-family:tahoma,sans-serif">A
random paragraph on pg 11 --</div>
<div class="gmail_default" style="font-family:tahoma,sans-serif"><br>
</div>
<div class="gmail_default" style="font-family:tahoma,sans-serif"><b>For
the first time, BlackBerry researchers have assessed that
these groups are all<br>
sharing a previously unidentified Linux malware toolset
referred to in this report as the<br>
WINNTILNX toolset. It should be noted that these groups have
also been observed<br>
targeting other platforms as well, including Windows,
Android, and MacOS.<br>
Four of these five groups are already known to the security
community as PASSCV,<br>
BRONZE UNION (aka APT27, EMISSARY PANDA), a group tracked
internally as CASPER<br>
(aka LEAD), and the original WINNTI GROUP. But the fifth
Linux splinter cell group, which<br>
BlackBerry researchers are tracking as WLNXSPLINTER, is
discussed for the first time<br>
in this report. These threat actor groups share three
important characteristics:</b></div>
<div>
<div dir="ltr" class="gmail_signature"
data-smartmail="gmail_signature">
<div dir="ltr">
<div><br>
</div>
<div>
<div style="font-family:tahoma,sans-serif"
class="gmail_default">Seems to imply that the paper is
worth at least a glance?<br>
</div>
<br>
</div>
<div>Thanks,<br>
<br>
Ron Singh</div>
</div>
</div>
</div>
</div>
</blockquote>
<br>
</body>
</html>